Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe
Resource
win10v2004-20220812-en
General
-
Target
fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe
-
Size
508KB
-
MD5
6b3f6df19ee5f369d8b474fd8be43dff
-
SHA1
c8a2019e5023872a3ba84f344dbeeeeb46aee6a3
-
SHA256
fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f
-
SHA512
fee80bd4b801b75cc579abea1e837a90822336b79b09c7d1e1549ba0176280936b92767e86ac01a9396bd0de1a9fb04f6b4b931c9c5ac134ed203efc1c2f92d7
-
SSDEEP
6144:o3xV7htOfFiktSdWyKYAWFCbW7LYxLk+4MGT+N50cIXv+1coDdkozx3pypmlNH9J:o3xxPuFVtSdWJsuWXLGMvxsltRok/Gy
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\5116369f\\X" Explorer.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" eosRo6jbz1.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" deuxuj.exe -
Executes dropped EXE 11 IoCs
pid Process 1328 eosRo6jbz1.exe 1148 deuxuj.exe 1088 2veg.exe 2028 2veg.exe 1492 2veg.exe 1568 2veg.exe 1892 2veg.exe 1800 2veg.exe 2008 3veg.exe 332 csrss.exe 572 X -
resource yara_rule behavioral1/memory/2028-83-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2028-84-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2028-85-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1492-90-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2028-91-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2028-93-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1492-94-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1492-96-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1492-101-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1492-102-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1568-105-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1568-107-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1568-108-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1892-113-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1892-116-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1892-114-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1568-117-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1568-121-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1892-122-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1892-123-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2028-129-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1492-130-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1568-131-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1892-132-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2028-174-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/1568-175-0x0000000000400000-0x0000000000426000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1968 cmd.exe -
Loads dropped DLL 10 IoCs
pid Process 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 1328 eosRo6jbz1.exe 1328 eosRo6jbz1.exe 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 2008 3veg.exe 2008 3veg.exe -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /G" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /q" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /t" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /j" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /Y" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /R" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /O" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /J" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /s" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /V" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /y" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /M" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /n" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /r" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /X" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /w" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /L" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /B" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /F" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /S" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /I" deuxuj.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /e" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /l" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /N" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /E" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /H" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /s" eosRo6jbz1.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /h" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /T" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /x" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /K" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /d" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /C" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /v" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /a" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /D" deuxuj.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ eosRo6jbz1.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /P" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /A" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /c" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /u" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /m" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /z" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /Z" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /W" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /k" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /i" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /o" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /f" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /p" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /b" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /g" deuxuj.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\deuxuj = "C:\\Users\\Admin\\deuxuj.exe /U" deuxuj.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2veg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2veg.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1088 set thread context of 2028 1088 2veg.exe 34 PID 1088 set thread context of 1492 1088 2veg.exe 35 PID 1088 set thread context of 1568 1088 2veg.exe 36 PID 1088 set thread context of 1892 1088 2veg.exe 37 PID 1088 set thread context of 1800 1088 2veg.exe 38 PID 2008 set thread context of 664 2008 3veg.exe 42 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 268 tasklist.exe 1984 tasklist.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \registry\machine\Software\Classes\Interface\{3097c7e0-1ac2-2f18-0d68-79804155316e} 3veg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3097c7e0-1ac2-2f18-0d68-79804155316e}\u = "188" 3veg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3097c7e0-1ac2-2f18-0d68-79804155316e}\cid = "17492274625613067495" 3veg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1328 eosRo6jbz1.exe 1328 eosRo6jbz1.exe 1492 2veg.exe 1568 2veg.exe 1148 deuxuj.exe 1148 deuxuj.exe 1492 2veg.exe 1148 deuxuj.exe 2008 3veg.exe 2008 3veg.exe 2008 3veg.exe 1148 deuxuj.exe 2008 3veg.exe 572 X 1148 deuxuj.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1492 2veg.exe 1148 deuxuj.exe 1148 deuxuj.exe 1148 deuxuj.exe 1148 deuxuj.exe 1492 2veg.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1148 deuxuj.exe 1148 deuxuj.exe 1148 deuxuj.exe 1492 2veg.exe 1492 2veg.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1568 2veg.exe 1492 2veg.exe 1148 deuxuj.exe 1148 deuxuj.exe 1148 deuxuj.exe 1492 2veg.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1492 2veg.exe 1148 deuxuj.exe 1148 deuxuj.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1492 2veg.exe 1148 deuxuj.exe 1492 2veg.exe 1492 2veg.exe 1148 deuxuj.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1204 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 268 tasklist.exe Token: SeDebugPrivilege 2008 3veg.exe Token: SeDebugPrivilege 2008 3veg.exe Token: SeDebugPrivilege 1984 tasklist.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 1328 eosRo6jbz1.exe 1148 deuxuj.exe 1088 2veg.exe 2028 2veg.exe 1892 2veg.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 332 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1328 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 27 PID 1760 wrote to memory of 1328 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 27 PID 1760 wrote to memory of 1328 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 27 PID 1760 wrote to memory of 1328 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 27 PID 1328 wrote to memory of 1148 1328 eosRo6jbz1.exe 28 PID 1328 wrote to memory of 1148 1328 eosRo6jbz1.exe 28 PID 1328 wrote to memory of 1148 1328 eosRo6jbz1.exe 28 PID 1328 wrote to memory of 1148 1328 eosRo6jbz1.exe 28 PID 1328 wrote to memory of 664 1328 eosRo6jbz1.exe 29 PID 1328 wrote to memory of 664 1328 eosRo6jbz1.exe 29 PID 1328 wrote to memory of 664 1328 eosRo6jbz1.exe 29 PID 1328 wrote to memory of 664 1328 eosRo6jbz1.exe 29 PID 664 wrote to memory of 268 664 cmd.exe 31 PID 664 wrote to memory of 268 664 cmd.exe 31 PID 664 wrote to memory of 268 664 cmd.exe 31 PID 664 wrote to memory of 268 664 cmd.exe 31 PID 1760 wrote to memory of 1088 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 33 PID 1760 wrote to memory of 1088 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 33 PID 1760 wrote to memory of 1088 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 33 PID 1760 wrote to memory of 1088 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 33 PID 1088 wrote to memory of 2028 1088 2veg.exe 34 PID 1088 wrote to memory of 2028 1088 2veg.exe 34 PID 1088 wrote to memory of 2028 1088 2veg.exe 34 PID 1088 wrote to memory of 2028 1088 2veg.exe 34 PID 1088 wrote to memory of 2028 1088 2veg.exe 34 PID 1088 wrote to memory of 2028 1088 2veg.exe 34 PID 1088 wrote to memory of 2028 1088 2veg.exe 34 PID 1088 wrote to memory of 2028 1088 2veg.exe 34 PID 1088 wrote to memory of 1492 1088 2veg.exe 35 PID 1088 wrote to memory of 1492 1088 2veg.exe 35 PID 1088 wrote to memory of 1492 1088 2veg.exe 35 PID 1088 wrote to memory of 1492 1088 2veg.exe 35 PID 1088 wrote to memory of 1492 1088 2veg.exe 35 PID 1088 wrote to memory of 1492 1088 2veg.exe 35 PID 1088 wrote to memory of 1492 1088 2veg.exe 35 PID 1088 wrote to memory of 1492 1088 2veg.exe 35 PID 1088 wrote to memory of 1568 1088 2veg.exe 36 PID 1088 wrote to memory of 1568 1088 2veg.exe 36 PID 1088 wrote to memory of 1568 1088 2veg.exe 36 PID 1088 wrote to memory of 1568 1088 2veg.exe 36 PID 1088 wrote to memory of 1568 1088 2veg.exe 36 PID 1088 wrote to memory of 1568 1088 2veg.exe 36 PID 1088 wrote to memory of 1568 1088 2veg.exe 36 PID 1088 wrote to memory of 1568 1088 2veg.exe 36 PID 1088 wrote to memory of 1892 1088 2veg.exe 37 PID 1088 wrote to memory of 1892 1088 2veg.exe 37 PID 1088 wrote to memory of 1892 1088 2veg.exe 37 PID 1088 wrote to memory of 1892 1088 2veg.exe 37 PID 1088 wrote to memory of 1892 1088 2veg.exe 37 PID 1088 wrote to memory of 1892 1088 2veg.exe 37 PID 1088 wrote to memory of 1892 1088 2veg.exe 37 PID 1088 wrote to memory of 1892 1088 2veg.exe 37 PID 1088 wrote to memory of 1800 1088 2veg.exe 38 PID 1088 wrote to memory of 1800 1088 2veg.exe 38 PID 1088 wrote to memory of 1800 1088 2veg.exe 38 PID 1088 wrote to memory of 1800 1088 2veg.exe 38 PID 1088 wrote to memory of 1800 1088 2veg.exe 38 PID 1760 wrote to memory of 2008 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 40 PID 1760 wrote to memory of 2008 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 40 PID 1760 wrote to memory of 2008 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 40 PID 1760 wrote to memory of 2008 1760 fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe 40 PID 2008 wrote to memory of 1204 2008 3veg.exe 8 PID 2008 wrote to memory of 332 2008 3veg.exe 25 PID 2008 wrote to memory of 572 2008 3veg.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe"C:\Users\Admin\AppData\Local\Temp\fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\eosRo6jbz1.exeC:\Users\Admin\eosRo6jbz1.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\deuxuj.exe"C:\Users\Admin\deuxuj.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1148
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del eosRo6jbz1.exe3⤵
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
-
-
C:\Users\Admin\2veg.exeC:\Users\Admin\2veg.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\2veg.exe"C:\Users\Admin\2veg.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028
-
-
C:\Users\Admin\2veg.exe"C:\Users\Admin\2veg.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1492
-
-
C:\Users\Admin\2veg.exe"C:\Users\Admin\2veg.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1568
-
-
C:\Users\Admin\2veg.exe"C:\Users\Admin\2veg.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1892
-
-
C:\Users\Admin\2veg.exe"C:\Users\Admin\2veg.exe"3⤵
- Executes dropped EXE
PID:1800
-
-
-
C:\Users\Admin\3veg.exeC:\Users\Admin\3veg.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\5116369f\X*0*bc*d3ef4e7*31.193.3.240:533⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:572
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:664
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del fe7ae2c95b47e850988cccd893394b33f46d4c80d3583776eb2f24360f53d74f.exe2⤵
- Deletes itself
PID:1968 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1204
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:332
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD5116cdd8174ee4734183e8f019a548596
SHA1d918d4e4bdaec0f4066c2285a5bd85903d92e23f
SHA256dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a
SHA512377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933
-
Filesize
124KB
MD5116cdd8174ee4734183e8f019a548596
SHA1d918d4e4bdaec0f4066c2285a5bd85903d92e23f
SHA256dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a
SHA512377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933
-
Filesize
124KB
MD5116cdd8174ee4734183e8f019a548596
SHA1d918d4e4bdaec0f4066c2285a5bd85903d92e23f
SHA256dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a
SHA512377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933
-
Filesize
124KB
MD5116cdd8174ee4734183e8f019a548596
SHA1d918d4e4bdaec0f4066c2285a5bd85903d92e23f
SHA256dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a
SHA512377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933
-
Filesize
124KB
MD5116cdd8174ee4734183e8f019a548596
SHA1d918d4e4bdaec0f4066c2285a5bd85903d92e23f
SHA256dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a
SHA512377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933
-
Filesize
124KB
MD5116cdd8174ee4734183e8f019a548596
SHA1d918d4e4bdaec0f4066c2285a5bd85903d92e23f
SHA256dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a
SHA512377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933
-
Filesize
124KB
MD5116cdd8174ee4734183e8f019a548596
SHA1d918d4e4bdaec0f4066c2285a5bd85903d92e23f
SHA256dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a
SHA512377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933
-
Filesize
287KB
MD5357d9b4488d3191b0d6197015b326484
SHA1057455015523d5b0b475dce4a49d510ba6a23ee4
SHA2567444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36
SHA512f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc
-
Filesize
287KB
MD5357d9b4488d3191b0d6197015b326484
SHA1057455015523d5b0b475dce4a49d510ba6a23ee4
SHA2567444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36
SHA512f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
180KB
MD562296fa335d9974218b7cd72aacbf4d4
SHA1f5add8a71cb879be353f98c1c0323fbc6bc84328
SHA2568311c751f99108a14fb22b18bcc0d25704d76cbf42b0a462e926b7d04b56dc5b
SHA5128e939262c2789140e689655f9808bb67bae26011cb62e2aa0c11ba86852d5a7a252234f5c480b12a868ed57fdf8fd1274fcb2656928f00a339648e509d643795
-
Filesize
180KB
MD562296fa335d9974218b7cd72aacbf4d4
SHA1f5add8a71cb879be353f98c1c0323fbc6bc84328
SHA2568311c751f99108a14fb22b18bcc0d25704d76cbf42b0a462e926b7d04b56dc5b
SHA5128e939262c2789140e689655f9808bb67bae26011cb62e2aa0c11ba86852d5a7a252234f5c480b12a868ed57fdf8fd1274fcb2656928f00a339648e509d643795
-
Filesize
180KB
MD5582c4af3c13d489f7593c6655a9ed25f
SHA1f920f89e59010c5d24507a3556cfa2b8ed406ddc
SHA256560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5
SHA512f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d
-
Filesize
180KB
MD5582c4af3c13d489f7593c6655a9ed25f
SHA1f920f89e59010c5d24507a3556cfa2b8ed406ddc
SHA256560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5
SHA512f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d
-
Filesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
Filesize
124KB
MD5116cdd8174ee4734183e8f019a548596
SHA1d918d4e4bdaec0f4066c2285a5bd85903d92e23f
SHA256dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a
SHA512377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933
-
Filesize
124KB
MD5116cdd8174ee4734183e8f019a548596
SHA1d918d4e4bdaec0f4066c2285a5bd85903d92e23f
SHA256dc4a13e971df03dd33d12979f28cb17b17191a4d494a450c9d727d9843a9744a
SHA512377822fd02c198c84a76408bb05a48de49329ba5ab7f39f42b055d8684b8bd35b8d5f76cfd933206da391d85236af3f7dbcbb9ee4b9e5b793e52265a10cc1933
-
Filesize
287KB
MD5357d9b4488d3191b0d6197015b326484
SHA1057455015523d5b0b475dce4a49d510ba6a23ee4
SHA2567444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36
SHA512f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc
-
Filesize
287KB
MD5357d9b4488d3191b0d6197015b326484
SHA1057455015523d5b0b475dce4a49d510ba6a23ee4
SHA2567444e14894fdd4a92bf4fc447ac8884c230730cbd0156e84d9c37f23db4b6c36
SHA512f6e059efdbb604e3a2ad3a9d91d20061f03343dd387f2d88971a640a4fb142164c79ea275200a3dbe9ab2b21a16318b5fdd457c0464b900ea37497c7500373bc
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
38KB
MD572de2dadaf875e2fd7614e100419033c
SHA15f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
SHA256c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
SHA512e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
-
Filesize
180KB
MD562296fa335d9974218b7cd72aacbf4d4
SHA1f5add8a71cb879be353f98c1c0323fbc6bc84328
SHA2568311c751f99108a14fb22b18bcc0d25704d76cbf42b0a462e926b7d04b56dc5b
SHA5128e939262c2789140e689655f9808bb67bae26011cb62e2aa0c11ba86852d5a7a252234f5c480b12a868ed57fdf8fd1274fcb2656928f00a339648e509d643795
-
Filesize
180KB
MD562296fa335d9974218b7cd72aacbf4d4
SHA1f5add8a71cb879be353f98c1c0323fbc6bc84328
SHA2568311c751f99108a14fb22b18bcc0d25704d76cbf42b0a462e926b7d04b56dc5b
SHA5128e939262c2789140e689655f9808bb67bae26011cb62e2aa0c11ba86852d5a7a252234f5c480b12a868ed57fdf8fd1274fcb2656928f00a339648e509d643795
-
Filesize
180KB
MD5582c4af3c13d489f7593c6655a9ed25f
SHA1f920f89e59010c5d24507a3556cfa2b8ed406ddc
SHA256560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5
SHA512f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d
-
Filesize
180KB
MD5582c4af3c13d489f7593c6655a9ed25f
SHA1f920f89e59010c5d24507a3556cfa2b8ed406ddc
SHA256560158f5874f861a9d2024e72d11dd6c8f730c67fead128818454989479b35c5
SHA512f89286144121c22284dd9fc3b9e908d414b8d407c86f867e8485596ea847577b2a98dd8ab974ace842075c086f5aa80762e345d5f4487cb44a1ffafae6f3a21d
-
Filesize
29KB
MD51149c1bd71248a9d170e4568fb08df30
SHA16f77f183d65709901f476c5d6eebaed060a495f9
SHA256c2dcf387cb4d218f50463338291e7db38afbdab9aab88fc54e7f9283df1792d1
SHA5129e6eac8facb23b38552d37c9f3cb24098f871d2885ecb3630fcd0199c5600b12a42f095f9fbeb90e5632496491d46fd987660cdda695e92dc386bd482d3ff459
-
Filesize
2KB
MD540af3963a79222555eb57f76af1a8201
SHA1e6a76cf1b85a7142d3adc3f06fc640afef737118
SHA256e498cf69c90534654d96aa90205429ff9668b0273c9c1c4490626086a1dc163f
SHA5127a91bfb7ce9b1da411dc3abb2d289a0c77cdcaed9df0818f94e206a1660c2e114ca66e2ab9282f1060bcd4764d9cc0608905b17b98e44a15dc91d4bb3de616ac